Obfuscating transformations on data array content and addresses
In a first computer (digital) data obfuscation process, data which is conventionally arranged in a data structure called an array (e.g., a table) and conventionally stored in computer or computer device memory is obfuscated (masked) by logically or mathematically combining the data, entry-by-entry, with a masking value which is computed as a logical or mathematical function of the entry itself or its index in the array, modulo a security value. The complementary unmasking value is a pointer to the entry's address in the table modulo the security value. In a second computer (digital) data obfuscation process, the addresses (location designations) in memory of a data array are themselves obfuscated (masked) by partitioning the array into blocks of entries and shuffling the order of the data entries in each block by a predetermined algorithm, resulting in a shuffled array also differing from the original array in terms of its size (the total number of entries).
1. A method of obfuscating an array of data implemented by a machine comprising at least one processing unit and a machine readable storage, the method comprising:
computing a security parameter that is a function of a page number of a primary memory address of the array, wherein the primary address is a physical address of the first entry of the array;
computing a masking value by using a first function that takes as an input one of (i) an address of a selected entry from a plurality of entries of the array modulo the computed security parameter and (ii) an index of the selected entry modulo the computed security parameter;
computing an obfuscated value for the selected entry of the array by using an invertible second function that takes as input the computed masking value and a value of the selected entry of the array, wherein the computation of the security parameter, the masking value, and the obfuscated value are performed by the machine; and
storing the obfuscated value of the selected entry in the machine readable storage.
2. The method of claim 1 further comprising repeating, for each of the remaining entries of the array, the computing of an obfuscated value and the storing of the obfuscated value in the machine readable storage.
3. The method of claim 1 , wherein the invertible second function is one of an affine, logical, and arithmetic function, wherein the first function is respectively affine, logical, or arithmetic.
4. The method of claim 1 , wherein the first function is invertible.
5. The method of claim 1 , wherein the primary address of the array modulo the security parameter equals a predetermined constant value.
6. The method of claim 1 , wherein the first function is determined by the address of the selected entry of the array.
7. An apparatus for obfuscating an array of data, comprising:
a set of processing units; and
a non-transitory machine readable storage storing a program for execution by at least one processing unit, the program comprising sets of instructions for:
computing a security parameter that is a function of a page number of a primary memory address of the array, wherein the primary address is a physical address of the first entry of the array;
computing a masking value by using a first function that takes as an input one of (i) an address of a selected entry from a plurality of entries of the array modulo the computed security parameter and (ii) an index of the selected entry modulo the computed security parameter;
computing an obfuscated value for the selected entry of the array by using an invertible second function that takes as input the computed masking value and a value of the selected entry of the array; and
storing the obfuscated value of the selected entry.
8. The apparatus of claim 7 , wherein the program further comprises sets of instructions for:
computing an obfuscated value for each of the remaining entries of the array with a different computed masking value; and
storing the obfuscated value for each of the remaining entries.
9. The apparatus of claim 7 , wherein the invertible second function is one of an affine, logical, and arithmetic function, wherein the first function is respectively affine, logical, or arithmetic.
10. The apparatus of claim 7 , wherein the first function is invertible.
11. The apparatus of claim 7 , wherein the primary address of the array modulo the security parameter equals a predetermined constant value.
12. The apparatus of claim 7 , wherein the first function is determined by the address of the selected entry of the array.
13. A non-transitory machine readable storage medium storing a program for execution by at least one processing unit, the program comprising sets of instructions for:
computing a security parameter that is a function of a page number of a primary memory address of an array, wherein the primary address is a physical address of the first entry of the array;
computing a masking value by using a first function that takes as an input one of (i) an address of a selected entry from a plurality of entries of the array modulo the computed security parameter and (ii) an index of the selected entry modulo the computed security parameter;
computing an obfuscated value for the selected entry of the array by using an invertible second function that takes as input the computed masking value and a value of the selected entry of the array; and
storing the obfuscated value of the selected entry.
14. The non-transitory machine readable storage medium of claim 13 further comprising sets of instructions for:
computing an obfuscated value for each of the remaining entries of the array with a different computed masking value; and
storing the obfuscated value for each of the remaining entries.
15. The non-transitory machine readable storage medium of claim 13 , wherein the invertible second function is one of an affine, logical, and arithmetic function, wherein the first function is respectively affine, logical, or arithmetic.
16. The non-transitory machine readable storage medium of claim 13 , wherein the first function is invertible.
17. The non-transitory machine readable storage medium of claim 13 , wherein the primary address of the array modulo the security parameter equals a predetermined constant value.
18. The non-transitory machine readable storage medium of claim 13 , wherein the first function is determined by the address of the selected entry of the array.